feat(l1): v6 rollup upgrade deploy script, payload and runbook - #25496
Open
aminsammara wants to merge 1 commit into
Open
aminsammara wants to merge 1 commit into
aminsammara wants to merge 1 commit into
Conversation
aminsammara
requested review from
iAmMichaelConnor,
just-mitch and
koenmtb1
as code owners
September 16, 2026 14:26
aminsammara
force-pushed
the
payload-v6
branch
6 times, most recently
from
September 17, 2026 16:20
f310d40 to
a60f16a
Compare
Adds the deployment path for the v6 rollup upgrade. - DeployRollupForUpgradeV6.s.sol deploys the verifier, the rollup, the escape hatch and the governance payload. Every configuration value is a literal in _config(), branched for mainnet and Sepolia, so there are no env-var defaults and no network-defaults.json fallbacks that could change what is deployed; REGISTRY_ADDRESS is the only environment input. verify() reads each value back off the deployed contracts and asserts it matches the table. - V6UpgradePayload.sol registers the rollup with the Registry and the GSE, and moves the outgoing flush rewarder's unowed balance into a replacement bound to the new rollup. - V6UpgradeSimulation.sol runs the payload through the real governance lifecycle against a state snapshot and reverts it, so a deploy cannot succeed while producing a payload that would fail. - V6_UPGRADE_RUNBOOK.md documents the build, inputs, pre-flight checks, deploy, proposal and post-execution verification. The escape hatch is deployed and registered before ownership moves to governance, because setEscapeHatch is onlyOwner and one-shot. Not deployable as-is: the genesis roots, initialEthPerFeeAsset and the registry reward override values are left as TODOs.
aminsammara
force-pushed
the
payload-v6
branch
from
September 17, 2026 16:22
a60f16a to
2a6aa7f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the deployment path for the v6 rollup upgrade. Not ready to merge — see Outstanding below.
The main thing to review is the
_config()literal inDeployRollupForUpgradeV6.s.sol. It is the complete set of deploy-time rollup configuration, one line per knob, and reviewing it is sufficient to review what the rollup will be.What it deploys
DeployRollupForUpgradeV6.s.sol, in one broadcast:HonkVerifierRollup— owned by the deployer at construction, which also constructs itsInbox,Outbox,FeeJuicePortal,Slasher+SlashingProposerand a freshRewardBoosterEscapeHatch, thensetEscapeHatch— done here, while the deployer still owns the rollup, because that call isonlyOwnerand one-shottransferOwnership(governance)V6UpgradePayload(+ a replacementFlushRewarderon chains that have one)Nothing becomes canonical until governance executes the payload.
Configuration
REGISTRY_ADDRESSis the only environment input — fee asset, staking asset, GSE, governance and reward distributor are all derived from it and asserted against the outgoing rollup.Verification
verify(address)asserts every configured value back off the deployed contracts: genesis roots, timings, committee, staking, entry queue, fees, rewards (includinggetRegistryRewardOverrides), the full slashing stack viaSlasher/SlashingProposerimmutables, the escape hatch,Inbox/Outboxback-pointers and versions, and that governance owns the rollup.V6UpgradeSimulation.solthen runs the payload through the real governance lifecycle (GSEPayloadwrap → propose → vote → execute) against a state snapshot and reverts it. It proves the actions execute correctly; it does not predict whether a proposal would pass, since a simulation-only voter is given a majority.What the payload does
Registry.addRollupGSE.addRollupoldFlushRewarder.recover(...)No reward-distributor action is needed: it resolves the canonical rollup live off the registry, so its implicit pool follows v6 automatically.
Outstanding
vkTreeRoot,protocolContractsHash,genesisArchiveRoot— zero;run()refuses to deploy until setinitialEthPerFeeAsset— stale dev value, needs refreshing at deploy timeNotes
generated/HonkVerifier.solfrom a noir-projects bootstrap. Do not substitute a stub — it compiles and accepts every proof.0and a placeholder). Setting them is a governance call and belongs in the payload; the recipient must be set before any non-zero margin.V6_UPGRADE_RUNBOOK.mdcovers build, inputs, pre-flight checks, dry run, deploy, proposal and post-execution checks.